The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to browse the live web and ingest content from untrusted external sources, creating an attack surface for indirect prompt injection. 1. Ingestion points: Tools like codex_nav_and_wait, codex_dom_get_visible, and codex_dom_snapshot pull untrusted data from web pages into the agent context. 2. Boundary markers: The skill instructions do not specify any delimiters or safety warnings for handling content from the browser bridge. 3. Capability inventory: Extensive capabilities are provided, including executing arbitrary JavaScript (codex_evaluate), raw CDP commands (codex_execute_cdp), and accessing session cookies (codex_network_cookies). 4. Sanitization: Navigation is restricted to http/https, and CDP access is filtered via an allowlist.
[DYNAMIC_EXECUTION]: The skill provides tools for the execution of arbitrary scripts and commands within the browser context, notably through the codex_evaluate and codex_execute_cdp tools.
[DATA_EXFILTRATION]: The toolkit includes capabilities to read sensitive information such as session cookies via codex_network_cookies and local storage via codex_storage. Additionally, the codex_file_input tool allows the agent to upload files from the local filesystem, which could be misused to exfiltrate sensitive data if the agent is compromised by malicious web content.

codex-browser